Published: 06/03/2020 Updated: 09/03/2020
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

Zoho ManageEngine Desktop Central prior to 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

Vulnerability Trend

Affected Products

Vendor Product Versions
ZohocorpManageengine Desktop Central10


## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::AutoCheck include Msf::Exploit::CmdStager include Msf:: ...

Recent Articles

Hey, China. Maybe you should have held your hackers off for a bit while COVID-19 ravaged the planet. Just a suggestion
The Register • Gareth Corfield • 26 Mar 2020

Citrix, Cisco and Zoho-pwning APT41 attack wave seems in awfully bad taste

Proving that no good crisis ever goes to waste, Chinese government hacking crew APT41 launched a campaign that abuses vulns in Citrix Netscaler and Zoho ManageEngine, according to threat intel outfit FireEye.
As well as targeting load balancers and network management suites, the Chinese interference operatives spent three months, at the height of Wuhan's COVID-19 coronavirus outbreak, exploiting weaknesses in Cisco routers.
"This activity is one of the most widespread campaigns we ha...

Chinese Hackers Exploit Cisco, Citrix Flaws in Massive Espionage Campaign
Threatpost • Lindsey O'Donnell • 25 Mar 2020

Researchers warn that APT41, a notorious China-linked threat group, has targeted more than 75 organizations worldwide in “one of the broadest campaigns by a Chinese cyber-espionage actor observed in recent years.”
Between Jan. 20 and March 11, researchers observed APT41 exploiting vulnerabilities in Citrix NetScaler/ADC, Cisco routers and Zoho ManageEngine Desktop Central as part of the widespread espionage campaign. Researchers said it’s unclear if APT41 attempted exploitation en ma...

Chinese Hackers Use Cisco, Citrix, Zoho Exploits In Targeted Attacks
BleepingComputer • Sergiu Gatlan • 25 Mar 2020

The Chinese state-sponsored group APT41 has been at the helm of a range of attacks that used recent exploits to target security flaws in Citrix, Cisco, and Zoho appliances and devices of entities from a multitude of industry sectors spanning the globe.
It is not known if the campaign that started in January 2020 was designed to take advantage of companies having to focus on setting up everything needed by their remote workers while in COVID-19 lockdown or quarantine but, as FireEye resea...

Zoho Fixes No-Auth RCE Zero-Day in ManageEngine Desktop Central
BleepingComputer • Sergiu Gatlan • 06 Mar 2020

Web-based office suite and SaaS services provider Zoho released a security update to fix a remote code execution vulnerability found in its ManageEngine Desktop Central endpoint management solution that does not require authentication to be exploited.
Desktop Central helps companies like managed service providers (MSPs) to manage devices such as servers, laptops, desktops, smartphones, and tablets from a central location, and to automate frequent endpoint management routines like pa...